Your medical history, fragmented across a dozen patient portals, in one place on your server: MediKeep (formerly Personal Medical Records Keeper) is a self-hosted health record system. Built with a React frontend and FastAPI backend over PostgreSQL, it organizes 14 categories of medical data - medications with dosages and schedules, conditions, procedures, allergies, immunizations, symptoms, injuries, doctor visits and encounters, treatments, lab results, and even medical equipment with service dates and supplier info. Treatment management is genuinely sophisticated: an advanced mode links treatments to their medications with per-medication overrides for prescriber, pharmacy, and effective dates, and reverse lookup shows which treatments use a given medication. A dashboard summarizes records and recent activity, file uploads attach documents to records, and tagging works across categories. When a new specialist asks for your history, the report builder assembles custom reports by category and exports to PDF, JSON, or CSV - a curated, portable summary instead of a folder of photocopies. Authentication supports Google and GitHub SSO with OIDC providers like Keycloak and Authelia expected to work, and the built-in backup system protects the archive. Health data is exactly what should never live in someone else's cloud.

Stop pasting passwords into chat threads that keep them forever: 1time turns a secret into a link that opens once and then deletes itself. Paste a database URL, an API key, or any sensitive text, choose how long the link may live, from an hour to thirty days, and decide whether one person or up to ten may open it. Add a passphrase when the link alone should not be enough, then copy the ready link and send it through whatever channel you already use. The recipient opens it, sees the decrypted message with a copy button, and the message is burned, gone from the server the moment it is read. Files work the same way up to 250 MB, encrypted with their name and type and uploaded in pieces so a dropped connection only resends one chunk. Encryption happens in your browser before anything uploads, and the key travels inside the link itself, so the server holds only ciphertext it cannot read. A password generator, a command line client, and a browser extension that shares selected text speak the same protocol against your own instance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Roughly $1M of development work, open-sourced: Maybe Finance began as a $249/year commercial personal finance product before the company released it all. It aggregates bank accounts, credit cards, loans, investments, crypto, and real estate into a single net worth dashboard with historical trend charts - replacing the spreadsheet that usually glues a whole portfolio together. Transactions are categorized and tagged with rules, with merchant tracking and search across imported or synced activity; budgets track spending by category against plan; and the investment view follows holdings, cost basis, and returns across brokerage accounts. Multi-currency support converts accounts held in different currencies into a single reporting currency, bank synchronization works through Plaid where supported, and manual CSV import covers any institution. An optional AI assistant answers questions grounded in your own financial data. Because the app was built as a paid product with professional design before being open-sourced, its interface quality exceeds most community finance tools - and self-hosting means your balances and transactions are not monetized by a free app or gated behind an annual subscription. The stack is Ruby on Rails with Hotwire on PostgreSQL, licensed AGPL-3.0 and deployed via Docker. The original repository is archived; development continues in the community fork Sure, compatible with the same self-hosted setup.

The CAPTCHA bargain - annoy your users and feed their behavior to Google - gets replaced with economics by mCaptcha. Instead of image puzzles, it uses SHA256 proof-of-work: every visitor's browser silently solves a small computational challenge (via a WebAssembly library) before submitting a form. Humans never notice the milliseconds; bots hammering your site must burn more compute sending requests than your server spends answering them, which makes attacks more expensive than defense - the property that also makes mCaptcha genuine DoS protection, not just bot filtering. Written in Rust, the system is fully automated: difficulty scales with traffic, so challenges stay trivial in normal conditions and harden under attack. The privacy and accessibility wins are structural rather than promised: no tracking, no profiling, no user-pattern data collection, and no visual puzzles that exclude users with visual or cognitive impairments - the design was published in Communications of the ACM. Rate limiting is IP-independent, so users behind NATs, VPNs, or Tor get the same experience instead of endless challenge loops, and proofs resist replay attacks, neutering captcha farms. Migration is deliberately easy: the API is compatible with reCAPTCHA and hCaptcha, making it a drop-in replacement. AGPL-licensed core with proprietary-friendly client libraries.

Google's search results without Google's surveillance: Whoogle is a self-hosted proxy that strips the tracking and keeps the results. Your query goes from browser to your Whoogle instance, which fetches results from Google with a randomly generated User Agent and strips everything hostile before returning them: no ads or sponsored content, no third-party JavaScript or cookies, no AMP links, no URL tracking tags like utm_source, no referrer header - and Google sees your server's IP, never yours. Unlike metasearch engines that blend sources, Whoogle proxies Google exclusively, so result quality is exactly what you'd get logged out and incognito, minus the noise. A lightweight Flask app configured entirely through environment variables, it supports DuckDuckGo-style bang shortcuts, autocomplete suggestions, safe search, per-country and per-language filtering, site blocklists, and automatic rewriting of social links to privacy front-ends like Nitter and Invidious. Privacy hardening goes further: built-in Tor routing makes Google see an exit node instead of your server, HTTP/SOCKS proxy support covers other setups, and POST-based queries keep search terms out of logs. Light, dark, and fully custom CSS themes plus browser search-engine registration make it a drop-in default on desktop and mobile. Stateless, tiny, and trivial to run.

Machine translation with no Google, no Azure, no per-character billing, and no text leaving your infrastructure: LibreTranslate is a free, open-source translation API that runs entirely on your own server. The engine underneath is Argos Translate, which runs OpenNMT neural models with SentencePiece tokenization and Stanza sentence-boundary detection, all offline. Models install as portable .argosmodel packages covering dozens of languages - English, Spanish, French, German, Chinese, Japanese, Russian, Arabic, Hindi, Portuguese, and many more - and Argos handles automatic pivoting: with es-to-en and en-to-fr installed, it chains them to translate es-to-fr without a direct model. The API is a straightforward HTTP POST to /translate with source and target language codes, returning JSON - simple enough that the ecosystem has clients in every major language and integrations across tools like Weblate and Mastodon. Beyond plain text it translates HTML while preserving markup and handles whole file uploads (documents in, translated documents out), plus automatic language detection when the source is unknown. A clean bundled web UI serves interactive translation for end users, and optional API keys with rate limits control access. AGPL-licensed and trainable with custom models, it is the standard answer when translation must be private, unmetered, and self-contained - GDPR-sensitive text never touches a third party.

Telegram Desktop's export is a file you make once by hand; Telegram Archive is a self-hosted backup that keeps saving your chats on a schedule and in real time, then lets you read them in a viewer that looks like Telegram. After one login with the code Telegram sends you, it stores messages, photos, videos, voice notes, stickers, documents, and link previews, saving each file once even when several chats share it. A live listener captures new messages, edits, and reactions as they happen, and a daily full pass fills any gaps. Every edit keeps its earlier text as a version, and with deletion tracking switched on, deleted messages stay in the archive marked as deleted. The viewer offers folders, forum topics, archived chats, pinned messages, polls, shared media, and search across every chat, plus a What changed feed of deletions, edits, and transcripts. Voice notes can be transcribed into searchable text by a server you run or rent. Family or colleagues get logins limited to chosen chats, or a share link that opens a single chat. One archive holds several accounts, a Telegram Desktop export can be imported for older history, and twelve themes suit phones and desktops. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0-or-later licensed.

Several EU data protection authorities have ruled Google Analytics deployments unlawful; Matomo (formerly Piwik) is the most complete open-source replacement - a full analytics platform with 30+ report types across visitors, actions, referrers, goals, and ecommerce. The self-hosted PHP/MySQL edition is free and keeps every byte of visitor data on your infrastructure, which matters more each year: several EU data protection authorities have ruled Google Analytics deployments unlawful, while Matomo configured for cookieless tracking is approved by France's CNIL for use without a consent banner. All reporting runs on 100% unsampled data - no extrapolation at high traffic volumes. The GDPR Manager handles data subject requests and deletion, with IP anonymization, retention controls, and Do Not Track support built in. A dedicated importer pulls your historical Google Analytics data so years of trends survive the migration. Core analytics cover campaigns, custom variables and dimensions, entry/exit pages, downloads, site search, and full ecommerce tracking with a comprehensive HTTP API for reporting and ingestion. Premium plugins extend the platform into Hotjar-class behavioral tooling - click and scroll heatmaps, session recordings, conversion funnels, form analytics, A/B testing - plus a tag manager and SAML SSO. For teams that need GA-equivalent depth with actual data ownership, Matomo is the realistic drop-in replacement.

With over 21,000 GitHub stars and six years of steady development through version 3.1.0, Neko transforms any Docker container into a fully interactive browser or desktop environment streamed to web browsers via WebRTC with sub-300-millisecond glass-to-glass latency. The Go backend captures X server display frames using the Pion WebRTC library while the Vue.js frontend renders the remote session with native audio synchronization, delivering a significantly smoother experience than Apache Guacamole or noVNC which rely on image-over-WebSocket approaches. Multiple users simultaneously view and collaboratively control the same session with real-time input synchronization and host-managed control passing between participants. Pre-built Docker images cover Firefox, Chromium, Google Chrome, Tor Browser, Brave, Vivaldi, and Microsoft Edge alongside full desktop environments including XFCE and KDE for running any Linux application. Neko Rooms provides multi-tenant deployment with a REST API for programmatic room provisioning, while Neko Apps extends the platform with additional containerized applications beyond browsers. Sessions persist on the server independently of client connections — close your laptop, reconnect from your phone, and resume exactly where you left off. Optional VPN and Tor integration routes traffic through encrypted tunnels for privacy-sensitive browsing. RTMP broadcasting streams sessions to external platforms. The embeddable client supports iframe integration for custom portals and applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

2FAuth generates TOTP, HOTP, and Steam Guard codes from any web browser, freeing your two-factor authentication from dependence on a single smartphone or app. Lose your phone, switch devices, or sit at a desktop computer, and your 2FA codes remain accessible through the web interface. The Laravel and Vue.js application stores account secrets in an encrypted SQLite database that backs up as a single file. Adding accounts works through camera-based QR scanning or manual secret key entry for services that only provide text codes. Group organization with drag-and-drop sorting keeps large collections navigable, categorized however you prefer. WebAuthn authentication with FIDO2 hardware keys protects vault access with phishing-resistant passwordless login, meaning the tool that secures your accounts is itself secured by the strongest available method. Automatic screen lock triggers after configurable idle time, and OTP obfuscation dots out generated codes until you tap to reveal them, preventing shoulder surfing in shared spaces. The REST API enables browser extensions and external applications to request codes programmatically. Import compatibility with Google Authenticator, Aegis, and 2FAS ensures painless migration without re-enrolling every account from scratch. PWA installation places 2FAuth on your device home screen for native-app-like instant access. Runs on a dedicated RepoCloud VPS with guaranteed resources and full root SSH access. AGPL-3.0 licensed.

Mailflow gathers every mailbox you own, the work account, the personal one, and the address stranded at a provider you left years ago, into one unified inbox hosted on your own server. All accounts merge into a single stream sorted by date, then sort themselves into Primary, Newsletters, Social, Notifications, and Other tabs, with a reclassify button for the ones that land wrong. Conversations group into threads, one click unsubscribes from detected newsletters, and full-text search reaches across every connected account at once. Writing mail gets a proper editor with formatting, tables, emoji, attachments, and smart address completion that learns from what you send, while inbox rules and a block list quietly move, archive, star, or trash messages by sender, subject, or content before you ever see them. New mail arrives with real-time toasts and push notifications, the interface installs as an app, speaks eleven languages, and can be reshaped with layouts, themes, and your own CSS. Accounts stay protected with two-factor authentication and single sign-on, contacts sync out over CardDAV, and an optional AI assistant can summarize a thread or draft the reply you are avoiding. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every account you run deserves its own browser identity, and FoxProfile keeps those identities permanently separate instead of letting them bleed into one another. Create a profile once and it remembers its device: screen, GPU, CPU cores, fonts, and canvas noise are generated on first launch and reused on every later one, so the fingerprint a site saw yesterday is the fingerprint it sees tomorrow. Sessions stick too: history, cookies, and logins live in the profile directory, and the tabs you left open reopen where you left them. Each profile carries its own proxy (HTTP, HTTPS, SOCKS4, or SOCKS5, with a built-in checker) while timezone and locale follow the exit IP automatically or stay pinned to your choice, and the Check IP button compares the exit address across three services and flags mismatches or datacenter addresses. Cookies move in and out as standard editor JSON or Netscape files, whole profiles travel as ZIP archives, and bulk actions launch, stop, or delete fleets at once. On a server, the web panel runs profiles headlessly so you can manage them and view their screens from anywhere, the REST API scripts everything, and the MCP server lets AI agents drive the browsers directly. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

EdenText is a full word processor, from quick notes to full-length books, that opens the docx and odt files you already have and keeps them looking the way Word or LibreOffice made them. Pages are real pages: A4 or Letter sizes, margins, headers and footers, footnotes, columns, and watermarks, with mirrored margins and chapters opening on the right-hand page when you are laying out a book. Paragraph, character, table, and list styles cascade with inheritance and chapter numbering, and tables sort rows and compute spreadsheet-style formulas. The academic toolbox is complete: table of contents, captions, cross-references, citations with bibliography, an alphabetical index, and LaTeX formulas. Reviewing works the way editors expect, with tracked changes, threaded comments in margin balloons, printable markup, spell checking in eight languages, and grammar checking for English. An optional AI assistant answers questions about the document and proposes edits as tracked changes through your own model provider. Nothing waits on a server: documents autosave in the browser, the app installs and works offline, and your words never leave the machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Hister is a private search engine for everything you have read or saved, indexing the full text of visited pages, local files, and imported browser history so one query finds the page you only half remember. Firefox and Chrome extensions capture each page as you browse, while a crawler and importers for browser history and bookmarks backfill earlier reading. Watched directories add local files to the same collection. Queries accept field filters, quoted phrases, wildcards, negation, date ranges, and aliases, with a readable stored preview beside each result. Opt-in semantic search matches documents by meaning through an Ollama, llama.cpp, or OpenAI-compatible embeddings endpoint. The same index answers in the browser, a terminal interface, the command line, an HTTP API, and an MCP server for AI assistants. Multi-user mode gives each person separate documents, rules, and access tokens, with password or OAuth sign-in, and public mode lets anonymous visitors search a curated index. Rebuild a research trail, recover a half-remembered article, or share one searchable knowledge base, with no telemetry. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

A personal Strava on your own server: Endurain is a self-hosted fitness platform that keeps your complete workout history, GPS routes, and health data out of a vendor's cloud. It ingests the standard device formats (.gpx, .tcx, and preferred .fit with full sensor data) via manual or bulk upload, and syncs directly with Strava and Garmin Connect so migrating years of history is straightforward - Garmin sync covers activities, gear, and body composition. The dashboard shows activity feeds with weekly and monthly statistics, routes on maps, and distance, speed, and training-volume trends over time, with definable goals that update automatically. Gear tracking is notably deep: log wetsuits, bicycles, shoes, racquets, skis, and snowboards, assign default gear per activity type, and track individual components like bike chains against replacement mileage. Multi-user support with admin and user roles, follower features, per-activity privacy settings, and configurable sign-up (email verification, admin approval) make it usable for clubs and coaches as well as individuals. Auth is serious for a fitness app: MFA TOTP, OIDC/SAML SSO, and email-based password resets via Apprise. The stack is Vue.js over a Python FastAPI backend with PostgreSQL, plus weight, steps, and sleep logging, imperial/metric units, multi-language support, and third-party app integration.

No cookies, no fingerprinting, no cross-site tracking, no personal data collection - Umami's privacy contract is the foundation of the open-source web analytics platform. IP addresses are hashed rather than stored, which makes it GDPR, CCPA, and PECR compliant by default - the consent banner can come off the site entirely. The tracking script is under 2 KB, roughly 20x smaller than Google Analytics, so measurement stops being a page-weight tax. The dashboard covers the core metrics - pageviews, visitors, bounce rate, visit duration, referrers, browsers, devices, and countries - with any date range and filtering by country or device. Beyond pageviews, custom events track clicks, form submissions, and signups via a data attribute or one JavaScript call, and advanced reports add funnels, user journeys, retention and cohort analysis, goals, and automatic UTM campaign tracking. Anonymous session views show individual visitor activity without identifying anyone. Teams share websites with role-based access, one instance manages unlimited sites, and a full REST API exposes every metric programmatically. MIT-licensed and self-hosted on PostgreSQL or MySQL via Docker, your analytics data never leaves your infrastructure.

Watch YouTube without the ads, accounts, or tracking, from a server you own: TubeHaus is a private YouTube client that keeps the familiar layout, URLs, and keyboard shortcuts. Your subscriptions, watch history, resume positions, Watch Later, and playlists live as files on the server, so every device in the house shares one library and picks up a video where another screen left it. Live streams play with segments fetched ahead of the player, and captions are transcribed on the fly when a stream has none. Chapters, storyboard previews, a mini player, and theater mode make long videos easy to navigate, while sponsors are skipped automatically and dislike counts come back to the page. Save videos offline in 1080p or 4K for trips, send playback to a TV from your phone without a separate casting dongle, and drive the television interface entirely from a remote. Imports arrive from a Google Takeout export, Invidious, NewPipe, or FreeTube, so years of subscriptions move over in minutes instead of being rebuilt by hand. A calm mode hides recommendations and Shorts when you only want to search and watch deliberately. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your house already has lights, locks, sensors, thermostats, and speakers from many brands, and Home Assistant gives them one local control room with no vendor cloud in the loop. To close the shutters when the outdoor temperature holds above 25 °C, or to be alerted when the garage door is left open, build the routine in the visual editor: When, And if, Then do. Scenes, scripts, and blueprints package it for reuse, and run traces show what it did. More than 1,500 integrations cover Zigbee, Z-Wave, Matter, Thread, MQTT, ESPHome, Bluetooth, Hue, and Sonos, and network discovery offers known devices for one-step setup. To see the house at a glance, drag tile, thermostat, gauge, graph, and map cards into a dashboard, then put it on a TV with Home Assistant Cast. The Energy dashboard answers where the power goes, drawing solar, grid, battery, gas, and water as one distribution diagram with cost totals and per-appliance tracking. To talk to the house, use Assist: natural-language commands, wake words, and custom sentences run locally or through Home Assistant Cloud. The map panel shows who is home, plotting people against zones such as Home, Work, and School from the iOS and Android companion apps. Areas and labels keep large setups tidy, and multi-factor authentication guards each account. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.